CVE-2026-80191: GROWI Authentication Bypass Vulnerability

CVE-2026-80191 Overview

CVE-2026-80191 is a missing authorization vulnerability [CWE-862] in the GROWI collaborative wiki platform. The flaw exists in the retrieveAttachmentFromIdParam function within apps/app/src/server/routes/attachment/get.ts. GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. Unauthenticated requests skip the check entirely, and the handler returns the requested file. The vulnerable routes /attachment/:id and /download/:id accept the attachment identifier directly from the URL path. Any caller who possesses or recovers an attachment identifier can retrieve the file, even when the parent page is private.

Critical Impact
Unauthenticated attackers with knowledge of an attachment identifier can download files from private GROWI pages, bypassing all page-viewer permission controls.

Affected Products

GROWI versions prior to 8.0.2
GROWI v8.0.1 (confirmed vulnerable via source reference)
Fixed in GROWI v8.0.2

Discovery Timeline

2026-08-26 - CVE-2026-80191 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80191

Vulnerability Analysis

The vulnerability resides in the attachment retrieval path handler exposed at /attachment/:id and /download/:id. The handler function retrieveAttachmentFromIdParam performs a page-viewer permission check to determine whether the requester can access the attachment's parent page. That check is wrapped in a conditional block that requires the request to carry a non-null authenticated user object. When the request arrives without a session, the guard short-circuits and the check is skipped. The handler proceeds to load the attachment by its path parameter and returns the file bytes to the caller.

The route accepts the attachment identifier directly from the URL path. An unauthenticated client who supplies a valid identifier receives the file regardless of the parent page's visibility or the caller's authorization state.

Root Cause

The root cause is an inverted authorization pattern. The developer treated the presence of an authenticated user as a precondition for enforcing permissions, rather than as one of several inputs to a policy decision that must always execute. The correct design applies the same viewer check to authenticated and unauthenticated requests alike. GROWI v8.0.2 implements this design, only skipping the check when a valid share link has already bound the requested file to that link's page.

Attack Vector

An attacker sends an unauthenticated HTTP GET request to /attachment/:id or /download/:id with a known attachment identifier. Identifiers can be retained by a user whose access was later revoked. Identifiers can also be recovered from browser history, referrer headers, backups, chat logs, or other locations where the URL was previously exposed. The server returns the attachment content directly, without any session or permission validation. See the VulnCheck Advisory on GROWI and GROWI Attachment Route Code for the vulnerable source.

Detection Methods for CVE-2026-80191

Indicators of Compromise

Access log entries showing HTTP GET requests to /attachment/:id or /download/:id without an accompanying session cookie or authentication header.
Repeated attachment retrieval requests from a single source IP address enumerating identifier values.
Attachment downloads originating from IP addresses that never authenticated to the GROWI instance.
Requests to attachment routes referencing files whose parent pages are marked private.

Detection Strategies

Correlate GROWI reverse-proxy or application access logs against authentication events, and flag attachment retrievals that lack a preceding authenticated session.
Build a rule that alerts on any 200 OK response from /attachment/ or /download/ paths when the request carries no session cookie.
Baseline normal attachment access volume per user and per source and alert on statistical outliers, particularly from unauthenticated origins.

Monitoring Recommendations

Forward GROWI application logs and upstream web server logs to a centralized log platform for retention and search.
Monitor for scanning behavior against attachment endpoints, including sequential or high-entropy identifier probing.
Track file access patterns against page visibility metadata to identify private-content exposure.

How to Mitigate CVE-2026-80191

Immediate Actions Required

Upgrade GROWI to version 8.0.2 or later. The fix is contained in the release referenced by GROWI Release v8.0.2 and GitHub Pull Request #11756.
Review historical access logs for unauthenticated requests to /attachment/:id and /download/:id to identify potential data exposure.
Rotate or invalidate any attachment identifiers known to have been exposed externally, if the platform supports regeneration.

Patch Information

GROWI v8.0.2 runs the page-viewer permission check for authenticated and unauthenticated requests alike. The check is skipped only when a valid share link has already bound the requested file to that link's page. Review the fix in GitHub Pull Request #11756 and download the release from the GROWI Release v8.0.2 page.

Workarounds

Place the GROWI instance behind a reverse proxy or authentication gateway that rejects unauthenticated requests to /attachment/ and /download/ paths until the upgrade is applied.
Restrict network exposure of the GROWI instance to trusted networks or VPN-connected clients while the patched version is being deployed.
If a reverse proxy is unavailable, apply web application firewall rules that require a valid session cookie on requests to attachment retrieval routes.

bash

# Example NGINX configuration to require an authenticated session cookie
# on GROWI attachment routes as a temporary mitigation
location ~ ^/(attachment|download)/ {
    if ($cookie_connect_sid = "") {
        return 401;
    }
    proxy_pass http://growi_upstream;
}